CCTV CODE OF PRACTICE V2.0 August 2012
the place of useful learning The University of Strathclyde is a charitable body, registered in Scotland, number SC015263 Contents 1. NOMENCLATURE... 2 2. PURPOSE... 2 3. SYSTEM DESCRIPTION... 2 4. CONTROL ROOM OPERATION... 3 4.1 Access to Control Room... 3 4.2 Staff Vetting... 3 4.3 Authorised Operation of CCTV Equipment... 3 4.4 Training... 3 4.5 Liaison with the Police... 4 4.6 Processing of Images... 4 4.6.1 Recording of Images & Production of Still/Video Images... 4 4.6.2 Viewing of Recorded Images... 5 4.6.3 Removal of Video Tapes / DVDs... 5 4.7 Care of Digital Recording Systems... 5 5. DATA PROTECTION... 6 5.1 Disclosure to Third Parties... 6 5.2 Right of Subject Access... 7 6. COMPLIANCE... 7 7. REVIEW... 8 Page 1
1. NOMENCLATURE CCTV Closed Circuit Television IT PTZ Information Technology Pan Tilt and Zoom DVR Digital Video Recorder UOS University of Strathclyde CDROM Compact Disc Read Only Memory DVD Digital Versatile Disc IMP Information Management Programme 2. PURPOSE The purpose of the University CCTV Systems on the Campus is to provide staff, students & visitors with a physical surveillance system that will enhance safety, security and the prevention and detection of crime. This document refers to the systems operated and controlled by the University s Estates Services. 3. SYSTEM DESCRIPTION For the purpose of this Code of Practice CCTV equipment includes cameras, transmission, monitoring and retrieval equipment as defined in BS 7958. Estates Services operate a number of streetscape cameras covering both the John Anderson and Jordanhill Campus. There are further cameras within university buildings monitoring both public and secure areas. Most of these cameras are static, although there are fully functional cameras in strategic locations. All of the cameras are centrally controlled and monitored at John Anderson Campus Security Control, located in the Livingstone Tower, Richmond Street. There are secondary monitoring centres within the David Stow building, Jordanhill Campus, the Village Office, within the Lord Todd Building and within 181 St James Road This Code of Practice applies to all CCTV equipment operated by Estates Services at the above locations. There are also independent systems within a limited number of locations. These cameras are recorded locally and are not under the control of Estates Services. Page 2
4. CONTROL ROOM OPERATION The system shall be operated and maintained in accordance with this Code of Practice. A paper copy of this Code of Practice is located at the CCTV control desk for reference purposes. All operating staff are to be fully conversant with the guidelines and Operating Instructions for the Control Equipment as outlined in this Code of Practice. It is the responsibility of the Security Supervisor to ensure that any forms mentioned in this policy are available to Security Services staff as required. 4.1 Access to Control Room Access to control rooms is strictly controlled. All persons other than security personnel entering the control room are required to complete the log detailing who, when and why they had reason to gain access to the control room. It is the responsibility of the duty senior warden to ensure that the log is completed. 4.2 Staff Vetting All staff who have access to the CCTV control equipment shall have had a Standard Disclosure Scotland check carried out. 4.3 Authorised Operation of CCTV Equipment The Security Supervisor is the person responsible for the operation of the CCTV equipment and for ensuring no unauthorised or inappropriate use is made of the system. The use of the system is to be restricted to the intended purpose of the system as outlined in Section 2. Use outside the defined scope may constitute a criminal act. Only persons who have received full training on the operation and use of the CCTV equipment shall be authorised to operate the equipment. Persons operating the system will not use the cameras to focus through windows of University premises unless acting under specific instructions of the Security Shift Supervisor, or his or her Depute Warden. Those instructions will only be issued in the event of an incident or threat to safety and security. Under no circumstances are cameras to be trained into private residencies or properties. Suspicious activities or incidents monitored and recorded by CCTV equipment shall be logged by the operator in the Daily Incident Log Sheet. The date, time, location, camera number and type of incident are to be noted for possible investigation. If a request is made by the police or other public body to conduct covert surveillance using the University s CCTV system, then written authority is required under the Regulation of Investigatory Powers (Scotland) Act (RIP(S)A) 2000. Local Authorities have no power to target individuals inside dwellings or motor vehicles. Breach of RIP(S)A is a criminal offence. All requests of this nature are to be recorded on a Request for Observation Record sheet. 4.4 Training Page 3
All operators require to undergo a programme of training on the system operation including relevant health and safety requirements. Documented training records for each authorised CCTV operator shall be maintained by the Security Services Manager. 4.5 Liaison with the Police Suspicious activities or incidents of note are to be brought to the attention of Police via telephone. 4.6 Processing of Images The Data Protection Act 1998 states that personal data must not be retained for longer than is necessary for the purpose for which it was collected. It is Estates Services policy that CCTV data is kept for 14 days, after which time the data is deleted or destroyed. The DVR units are programmed to automatically delete any recorded video files which are older than 14 days. Any images retained (on CDROM or DVD) to be used as evidence are kept securely within the Security Supervisors office. The Security Supervisors are responsible for production of any images to be retained for evidential purposes. Any such images will be retained only for as long as required (for the purpose of providing evidence) and will then be destroyed. Access to the DVRs is limited to access at the DVR units themselves or authorised workstations, and only then to persons who have correct levels of access. The DVRs are all only accessible to persons having correct login identification and password. The DVRs and their associated monitors are all located in rooms away from the general public where private viewing can be facilitated. 4.6.1 Recording of Images & Production of Still/Video Images With the advent of digital recording media, the transportation and multiple copying of video images is very much simpler. It also means images can be transported across the world instantly as email attachments/uploads to websites etc. It is very important that the risk which this presents to individual privacy is recognised and appropriate steps taken to prevent unauthorised access to the recordings. With this in mind, it is expressly forbidden to make or take any recordings from the CCTV digital recording systems without proper cause. Where digital video evidence is to be used by the Police or other law enforcement authority (see Section 5.1), an entry will be made into the Incident Management System (IMP), which details what has been recorded and when this was done. It will also record the Supervisor who carried out the recording, verification & watermarking and the police officer whom the recording was handed to. When a recording of images from the DVR is made, the location of all copies of the file are to be noted in the Recording Record Sheet, the location of all copies of recording must be constantly known and recorded. The CDROM or DVD which is handed to the Police will be marked with the IMP record number, in permanent felt pen, to help tracking of the recording. All the copies of footage recorded from the CCTV system onto either a PC, CDROM or DVD are to be recorded in the IMP system against the production record. Each disc is to be given an individual number. All recorded Page 4
images (static or motion) removed (i.e. images saved onto another system or media) from the digital recorders must be recorded in the Incident Log and Video Record Sheet. Additionally all activity on the DVR units is automatically logged on the unit. 4.6.2 Viewing of Recorded Images Only authorised persons will be permitted to view recorded images. This may include an officer from an authorised law enforcement agency, such as the police. The viewing of recorded images is only to be carried out in connection with the purposes defined in section 2 and in line with Data Protection legislation (section 5). Any use outside the defined purposes is a breach of the Data Protection Act. Recorded images must only be viewed in places where unauthorised persons cannot see the images. Each time a DVR is accessed a user identification and password must be entered. All actions on the DVR units are logged against the login ID. This helps ensure that there is an auditable trail. Where an authorised person is viewing images, this is to be recorded in the Third Party Viewing Record. The reviewing of recorded images is documented on the Internal Viewing Record. This is used where authorised persons within the University are reviewing footage. Where third parties, external to the University, are reviewing the footage the Third Party Viewing Record, shall be used. If the images are stored on CDROM or DVD for evidence purposes, this would be recorded on the Productions Record Form. 4.6.3 Removal of Video Tapes / DVDs Removal of tapes or other recorded media from under University control requires to be authorised by the Security Supervisor or depute and clearly recorded on 1) Individual Tape Record Sheet, 2) IMP system, and 3) Production Record Form. When tapes/cdroms/dvds have completed their life cycle (see section 4.6) they are to be logged out of the system and destroyed. A confirmation of destruction is to be obtained and displayed with the Individual Tape Record Sheet. All the digital recorders are configured to ensure that video is not stored for longer than the defined 14 days. 4.7 Care of Digital Recording Systems Digital video recorders are to have a diagnostic check carried out by the CCTV maintenance company as part of the routine quarterly maintenance. This should include system health, software patch status & hard disc capacity and reliability. All digital video recorders (DVR) are to have any software patches realised by the manufacturer applied as soon as possible. All digital video recorders are to be connected within a secure internal part of the university network and should not be available to persons outside the university. Page 5
All Digital Video Recorders must be held within a secure place, and must be password protected to prevent unauthorised access to the system, software or recordings. 5. DATA PROTECTION Under the Data Protection Act 1998 personal data includes any image from which an individual may be identified. The processing of personal data includes the recording, viewing, storage and destruction of personal data. The University is responsible for all CCTV owned and operated by the University and is the data controller for the requirements of the Data Protection Act 1998. 5.1 Disclosure to Third Parties Disclosure of recorded images to third parties will be controlled and consistent with the purpose for which the system was established. Any requests for images and subsequent disclosures e.g. by police, should be recorded and a record retained by Security Services in accordance with section 4.6.2. If police approach the University wishing to have access to images captured on the University s CCTV system they must provide a standard Personal Data Request Form (also known as a Section 29 form), in accordance with the relevant guidance issued by the Association of Chief Police Officers (ACPO) or the Association of Chief Police Officers in Scotland (ACPOS). The form should state clearly what information is requested, the purpose of obtaining the information i.e. required for an investigation concerning the apprehension or prosecution of offenders, and it must be signed by the investigating officer and counter-signed by an officer of a senior rank. Where the request is considered to be an emergency and time is of the essence the relevant member of Security Services staff will judge whether or not to provide the information without the submission of an appropriate form. Providing access to images to the Police without a completed standard form should be considered to be exceptional and not the University s standard practice, by either staff or law enforcement agencies. Other relevant agencies may not use standard forms to make requests for personal data. However, any request should: Be clearly identifiable as from the agency in question i.e. in writing, on headed paper, and signed by an officer of the agency. The University should take any steps it deems necessary to ensure as far as is practicable that the request is legitimate. Describe the nature of the information which is required. Describe the nature of the investigation (e.g. citing any relevant statutory authority to obtain the information). Certify that the information is necessary for the investigation. Page 6
Each request will be assessed on a case-by-case basis. In most cases the decision as to whether the University should provide CCTV footage will be taken by the Security Manager (or his/her depute). If there is doubt as to whether information should be released the Information Governance Unit dataprotection@strath.ac.uk should be consulted. N.B. Where Security Services staff have contacted the police regarding images captured on the CCTV system for the purposes of security or the prevention or detection of crime then the police will not be required to provide a Request for Personal Data /S29 form. Any disclosure made by the University to the police in these circumstances is considered to be in the legitimate interests of the University and in line with the purpose of the CCTV system. Any unauthorised disclosure or misuse of CCTV data by staff is a serious matter and may be considered a disciplinary issue. 5.2 Right of Subject Access Where a potential data subject wishes to obtain access to/copies of the recorded CCTV images of him/her, he/she is advised to complete the form Subject Access Request Form CCTV Images available via the Accessing your Personal Data section of the Data Protection web pages. The completed form should be returned to the Information Governance Unit with the appropriate fee ( 10) and any other required documentation. The University s Data Protection web pages contain all relevant information regarding Subject Access Requests (SARs). The University has 40 calendar days to respond to a SAR. The Information Governance Unit will process any SAR requesting CCTV footage in conjunction with Security Services. Where third parties can be identified from the footage the images may have to be obscured to prevent such identification. If images of third parties cannot be suitably obscured the University may not be able to grant the data subject access to the data. 6. COMPLIANCE The University will at all times comply with the current Data Protection legislation. In doing so the University will also refer to any relevant guidance produced by the Information Commissioner s Office, in particular any specific codes of practice related to CCTV (at the time of publication CCTV Code of Practice 2008 http://www.ico.gov.uk/for_organisations/data_protection/topic_guides/cctv.aspx) All staff dealing with CCTV equipment and recordings should be aware of the University and ICO codes of practice, the University s Data Protection policy and the University s Notification on the Register of Data Controllers (www.strath.ac.uk/dataprotection). In addition these staff members should receive appropriate training to ensure they are aware of the correct operation of the system and handling of personal data. Any misuse of information obtained from a video recording is a breach of the Data Protection Act. Any such breach is a serious issue and may result in disciplinary action being taken against the member of staff involved. In certain circumstances individual members of staff may also incur criminal liability. Page 7
The Security Services Manager shall carry out a weekly check of paperwork to ensure all procedures are being complied with. Results of the audit shall be recorded in the daily diary sheet. The time noted on each of the DVR units shall be checked weekly by the Security Services Supervisors. This will be logged in a System Time Check sheet. In line with best practice (and as outlined in the ICO Code of Practice) the Security Services Manager will ensure that regular audits are conducted into the operation of the system. 7. REVIEW A formal review of the University s CCTV Code of Practice and associated documentation will be carried out by the Security Services Manager on an annual basis. An evaluation of the system and equipment will also be undertaken annually by the Security Services Manager. All evaluations will be formally reported by the Security Services Manager to the Director of Estates Management. There are a number of forms associated with this policy. However, these are not included in the policy as these may, from time-to-time, be subject to minor changes in terms of content, format and layout. However, where the overall purpose of any form is changed or it is deemed that a form is no longer required this would constitute a change of this policy and the policy must be reviewed and updated accordingly. Estates Services is responsible for any amendments to the associated forms. Page 8